currently, you'd have to call LookupResources for each specific resource type and permission/relation